ARMInstructionFormatsandTimings Lastrevised:15thNovember1995 Theinformationincludedhereisprovidedingoodfaith,butnoresponsibilitycanbeacceptedfor anydamageorlosscausedfromtheuseofinformationcontainedwithinthisdocumentevenifthe authorhasbeenadvisedofthepossibilityofsuchloss. ThisisnotanofficialdocumentfromARMLtd;infactotherthanacoupleofnicepeoplefrom ARMlimitedpointingoutsomeofthecorrections,theyhavenoconnectionwiththisdocumentat all.Theydonotguaranteetohavefoundallthemistakesinthis,sodon’tblamethemwhenyou findsomemore. Corrections/amendmentsforthisdocumentwouldbemostwelcome.Theyshouldbereportedto RobinWattsattheaddressbelow. Throughoutthisdocument,a‘word’refersto32bits(thats4bytes)ofmemory.Ifyoudon’tlike this,tough. Thisdocumentisavailableinseveralforms.Anindextothemcanbefoundithttp://www.comlab.ox.ac.uk/oucl/users/robin.watts/ARMinstrs/ontheWorldWideWeb,orviaanonymousFTP toftp.comlab.ox.ac.ukin/tmp/Robin.Watts/ARMinstrs/README. 1.ProcessorModes ARMprocessorshaveausermodeandanumberofprivilegedsupervisormodes.Theseareused asfollows: IRQEnteredwhenanInterruptRequest(IRQ)istriggered. FIQEnteredwhenaFastInterruptRequest(FIQ)istriggered. SVCEnteredwhenaSoftwareInterrupt(SWI)isexecuted. UndefEnteredwhenanUndefinedinstructionisexecuted(NotARM2and3,whereSVCmode isentered). AbtEnteredwhenamemoryaccessattemptisabortedbythememorymanager(e.g.MEMC orMMU),usuallybecauseanattemptismadetoaccessnon-existentmemoryortoaccess memoryfromaninsufficientlyprivilegedmode(NotARM2and3,whereSVCmodeis entered). Ineachcasetheappropriatehardwarevectorisalsocalled. 2.Registers TheARM2and3have2732bitprocessorregisters,16ofwhicharevisibleatanygiventime (whichsixteenvariesaccordingtotheprocessormode).ThesearereferredtoasR0-R15. TheARM6andlaterhave3132bitprocessorregisters,again16ofwhicharevisibleatanygiven time. R15hasspecialsignificance.OntheARM2and3,24bitsareusedastheprogramcounter,and theremaining8bitsareusedtoholdprocessormode,statusflagsandinterruptmodes.R15is thereforeoftenreferredtoasPC. R15=PC=NZCVIFppppppppppppppppppppppMM Bits0-1and26-31areknownasthePSR(processorstatusregister).Bits2-25givetheaddress(in words)oftheinstructioncurrentlybeingfetchedintotheexecutionpipeline(seebelow).Thus instructionsareonlyeverexecutedfromwordalignedaddresses.

-2-MCurrentprocessormode 0UserMode 1Fastinterruptprocessingmode(FIQmode) 2Interruptprocessingmode(IRQmode) 3Supervisormode(SVCmode) NameMeaning NNegativeflag ZZeroflag CCarryflag VoVerflowflag IInterruptrequestdisable FFastinterruptrequestdisable R14,R14FIQ,R14IRQ,andR14SVCaresometimesknownas‘link’registersduetotheir behaviourduringthebranchwithlinkinstructions. TheARM6andlaterprocessorcoressupporta32bitaddressspace.Suchprocessorscanoperate inboth26bitand32bitPCmodes.In26bitPCmode,R15actsasonpreviousprocessors,and hencecodecanonlyberuninthelowest64MBytesoftheaddressspace.In32bitPCmode,all 32bitsofR15areusedastheprogramcounter.Separatestatusregistersareusedtostorethe processormodeandstatusflags.Thesearedefinedasfollows: NZCVxxxxxxxxxxxxxxxxxxxxIFxMMMMM NotethatthebottomtwobitsofR15arealwayszeroin32-bitmodes—i.e.youcanstillonlyget word-alignedinstructions.Anyattemptstowritenon-zerostothesebitswillbeignored. Thefollowingmodesarecurrentlydefined: MNameMeaning 00000usr2626bitPCUserMode 00001fiq2626bitPCFIQMode 00010irq2626bitPCIRQMode 00011svc2626bitPCSVCMode 10000usr3232bitPCUserMode 10001fiq3232bitPCFIQMode 10010irq3232bitPCIRQMode 10011svc3232bitPCSVCMode 10111abt3232bitPCAbtMode 11011und3232bitPCUndMode Extrapolatingfromtheabovetable,itmightbeexpectedthatthefollowingtwomodesarealso defined: MNameMeaning 00111abt2626bitPCAbtMode 01011und2626bitPCUndMode Theseareinfactundefined(andifyoudowrite00111or01011tothemodebits,theresulting chipstatewon’tbewhatyoumightexpect—i.e.itwon’tbea26-bitprivilegedmodewiththe appropriateR13andR14swappedin). Thefollowingtableshowswhichregistersareavailableinwhichprocessormodes:

-3-ModeRegistersavailable USRR0—R14R15 FIQR0—R7R8FIQ—R14FIQR15 IRQR0—R12R13IRQ—R14IRQR15 SVCR0—R12R13SVC—R14SVCR15 ABTR0—R12R13ABT—R14ABTR15(ARM6andlateronly) UNDR0—R12R13UND—R14UNDR15(ARM6andlateronly) TherearesixstatusregistersontheARM6andlaterprocessors.Oneisthecurrentprocessorstatusregister(CPSR)andholdsinformationaboutthecurrentstateoftheprocessor.Theotherfive arethesavedprocessorstatusregisters(SPSRs):thereisoneoftheseforeachprivilegedmode,to holdinformationaboutthestatetheprocessormustbereturnedtowhenexceptionhandlingin thatmodeiscomplete. TheseregistersaresetandreadusingtheMSRandMRSinstructionsrespectively. 3.Pipeline Ratherthanbeingamicrocodedprocessor,theARMis(inkeepingwithitsRISCness)entirely hardwired. TospeedexecutiontheARM2and3have3stagepipelines.Thefirststageholdstheinstruction beingfetchedfrommemory.Thesecondstartsthedecoding,andthethirdiswhereitisactually executed.Duetothis,theprogramcounterisalways2instructionsbeyondthecurrentlyexecutinginstruction.(Thismustbetakenaccountofwhencalculatingoffsetsforbranchinstructions). Becauseofthispipeline,2instructioncyclesarelostonabranch(asthepipelinemustrefill).Itis thereforeoftenpreferabletomakeuseofconditionalinstructionstoavoidwastingcycles.For example:

...
CMPR0,#0
BEQover
MOVR1,#1
MOVR2,#2
over
...

canbemoreefficientlywrittenas:

...
CMPR0,#0
MOVNER1,#1
MOVNER2,#2
...

4.Timings ARMinstructionsaretimedinamixtureofS,N,IandCcycles. AnS-cycleisacycleinwhichtheARMaccessesasequentialmemorylocation. AnN-cycleisacycleinwhichtheARMaccessesanon-sequentialmemorylocation. AnI-cycleisacycleinwhichtheARMdoesn’ttrytoaccessamemorylocationortotransfera wordtoorfromacoprocessor.

-4-AC-cycleisacycleinwhichawordistransferredbetweentheARMandacoprocessoroneither thedatabus(foruncachedARMs)orthecoprocessorbus(forcachedARMs). ThedifferenttypesofcyclemustallbeatleastaslongastheARM’sclockrating.Thememory systemcanstretchthem:withatypicalDRAMsystem,thisresultsin: •N-cyclesbeingtwicetheminimumlength(essentiallybecauseDRAMsrequirealonger accessprotocolwhenthememoryaccessisnon-sequential). •S-cyclesusuallybeingtheminimumlength,butoccasionallybeingstretchedtoN-cycle length(whenyou’vejustmovedsequentiallyfromthelastwordofonememory"row"tothe firstofthenextone1). •I-andC-cyclesalwaysbeingtheminimumlength. WithatypicalSRAMsystem,allfourtypesofcyclearetypicallytheminimumlength. Onthe8MHzARM2usedintheAcornArchimedesA440/1,anS(sequential)cycleis125nsand anN(non-sequential)cycleis250ns.Itshouldbenotedthatthesetimingsarenotattributesof theARM,butofthememorysystem.E.g.an8MHzARM2canbeconnectedtoastaticRAM systemwhichgivesa125nsNcycle.Thefactthattheprocessorisratedat8MHzsimplymeans thatitisn’tguaranteedtoworkifyoumakeanyofthetypesofcycleshorterthan125nsinlength. Cachedprocessors:AlltheinformationgivenisintermsoftheclockcyclesseenbytheARM. Thesedonotoccurataconstantrate:thecachecontrollogicchangesthesourceoftheclock cyclespresentedtotheARMwhencachemissesoccur. Generally,acachedARMhastwoclockinputs:the"fastclock"FCLKandthe"memoryclock" MCLK.Whenoperatingnormallyfromcache,theARMisclockedatFCLKspeedandalltypes ofcyclearetheminimumlength:cacheiseffectivelyatypeofSRAMfromthispointofview. Whenacachemissoccurs,theARM’sclockissynchronisedtoMCLK,thenthecachelinefill takesplaceatMCLKspeed(takingeitherN+3SorN+7Sdependingonthelengthofcachelines intheprocessorinvolved),thentheARM’sclockisresynchronisedbacktoFCLK. Whilethememoryaccessistakingplace,theARMisbeingclocked:however,aninputcalled NWAITisusedtocausetheARMcyclesinvolvednottodoanythinguntilthecorrectword arrivesfrommemory,andusuallynottodoanythingwhiletheremainingwordsarrive(toavoid gettingfurthermemoryrequestswhilethecacheisstillbusywiththecachelinerefill).ThesituationisalsocomplicatedbythefactthatthecachedARMcanbeconfiguredeitherforFCLKand MCLKtobesynchronoustoeachother(soFCLKisanexactmultipleofMCLK,andevery MCLKclockcyclestartsatjustaboutthesametimeasanFCLKcycle)orasynchronous(in whichcaseFCLKandMCLKcyclescanhaveanyrelationshiptoeachother). Allinall,thesituationisthereforequitecomplicated.Anapproximationtothebehaviouristhat whenacachelinemissoccurs,thecycleinvolvedtakesthecachelinerefilltime(i.e.N+3Sor N+7S)inMCLKcycles,withN-cyclesandS-cyclesprobablybeingstretchedasdescribedabove forDRAM,plusafewmorecyclestoallowfortheresynchronisationperiods.Foranymore details,youreallyneedtogetadatasheetfortheprocessorinvolved. 5.Instructions EachARMinstructionis32bitswide,andareexplainedinmoredetailbelow.Foreachinstructionclasswegivetheinstructionbitmap,andanexampleofthesyntaxusedbyatypicalassembler. 1Memorycontrollerstendtousethissimplestrategy:ifanN-cycleisrequested,treattheaccessas notbeinginthesamerow;ifanS-cycleisrequested,treattheaccessasbeinginthesamerowunless itiseffectivelythelastwordintherow(whichcanbedetectedquickly).Thenetresultisthatsome S-cycleswilllastthesametimeasanN-cycle;ifIremembercorrectly,onanArchimedestheseareS-cycleaccessestoanaddresswhichisdivisibleby16.ThepracticalconsequencesofthisforArchimedes codeare:(a)thatabout1in4S-cyclesbecomesanN-cycle,sinceforthispurpose,alladdressesare wordaddressesandsodivisibleby4;(b)thatitisoccasionallyworthtakingcaretoaligncodecarefullytoavoidthiseffectandgetsomeextraperformance.)

-5-Itshouldofcoursebenotedthatthemnemonicsyntaxisnotfixed;itisapropertyoftheassem-bler,nottheARMmachinecode. 5.1.ConditionCode Thetopnibbleofeveryinstructionisaconditioncode,soeverysingleARMinstructioncanbe runconditionally. Cond InstructionBitmapNoCondCodeExecutesif

0000xxxxxxxxxxxxxxxxxxxxxxxxxxxx0EQ(Equal)Z
0001xxxxxxxxxxxxxxxxxxxxxxxxxxxx1NE(NotEqual)˜ Z
0010xxxxxxxxxxxxxxxxxxxxxxxxxxxx2CS(CarrySet)C
0011xxxxxxxxxxxxxxxxxxxxxxxxxxxx3CC(CarryClear)˜ C
0100xxxxxxxxxxxxxxxxxxxxxxxxxxxx4MI(MInus)N
0101xxxxxxxxxxxxxxxxxxxxxxxxxxxx5PL(PLus)˜ N
0110xxxxxxxxxxxxxxxxxxxxxxxxxxxx6VS(oVerflowSet)V
0111xxxxxxxxxxxxxxxxxxxxxxxxxxxx7VC(oVerflowClear)˜ V
1000xxxxxxxxxxxxxxxxxxxxxxxxxxxx8HI(HIgher)Cand˜ Z
1001xxxxxxxxxxxxxxxxxxxxxxxxxxxx9LS(LowerorSame)˜ CorZ
1010xxxxxxxxxxxxxxxxxxxxxxxxxxxxAGE(Greaterorequal)N=V
1011xxxxxxxxxxxxxxxxxxxxxxxxxxxxBLT(LessThan)N=˜ V
1100xxxxxxxxxxxxxxxxxxxxxxxxxxxxCGT(GreaterThan)(N=V)and˜ Z
1101xxxxxxxxxxxxxxxxxxxxxxxxxxxxDLE(Lessorequal)(N=˜ V)orZ
1110xxxxxxxxxxxxxxxxxxxxxxxxxxxxEAL(Always)True
1111xxxxxxxxxxxxxxxxxxxxxxxxxxxxFNV(Never)False

Inmostassemblers,theconditioncodeisinsertedimmediatelyafterthemnemonicstub;omitting aconditioncodedefaultstoALbeingused. HS(HigherorSame)andLO(LOwer)canbeusedassynonymsforCSandCC(respectively)in someassemblers. TheconditionsGT,GE,LT,LErefertosignedcomparisonswhereasHS,HI,LS,LOreferto unsigned. EORingaconditioncodewith1givestheoppositeconditioncode. NB:ARMhavedeprecatedtheuseoftheNVconditioncode—youarenowsupposedtouse MOVR0,R0asanoopratherthanMOVNVR0,R0aswaspreviouslyrecommended.FutureprocessorsmayhavetheNVconditioncodereusedtodootherthings. Instructionswithfalseconditionsexecutein1Scycle,andnotimepenaltyisincurredbymaking aninstructionconditional. 5.2.DataProcessingInstructions

xxxx000aaaaSnnnnddddccccctttmmmmRegisterform
xxxx001aaaaSnnnnddddrrrrbbbbbbbbImmediateform

TypicalAssemblerSyntax:

MOVRd,#0
ADDEQSRd,Rn,Rm,ASLRc
ANDEQRd,Rn,Rm
TEQPPn,#&80000000
CMPRn,Rm

-6-CombinecontentsofRnwithOp2,underoperationa,placingtheresultsinRd. Iftheregisterformisused,thenOp2issettobethecontentsofRmshiftedaccordingtotas below.Iftheimmediateformisused,thenOp2=#b,ROR#2r. tAssemblerInterpretation 000LSL#cLogicalShiftLeft 001LSLRcLogicalShiftLeft 010LSR#cforc!=0LogicalShiftRight LSR#32forc=0 011LSRRcLogicalShiftRight 100ASR#cforc!=0ArithmeticShiftRight ASR#32forc=0 101ASRRcArithmeticShiftRight 110ROR#cforc!=0RotateRight. RRXforc=0RotateRightonebitwithextend. 111RORRcRotateRight Intheregisterform,Rcissignifiedbybits8-11;bit7mustbeclearifRcisused.(Ifyoucodea1 instead,you’llgetamultiply,aSWPorsomethingunallocatedinsteadofadataprocessing instruction.) Also,onlythebottombyteofRcisused—IfRc=256,thentheshiftswillbebyzero. "MOV[S]Ra,Rb,RLX"canbedonebyADC[S]Ra,Rb,Rb,withRLXmeaningRotateLeftonebit withextend. MostassemblersallowASLtobeusedasasynonymforLSL.Sinceopinionsdifferonwhatan arithmeticleftshiftis,LSListhepreferredterm. BysettingtheSbitinaMOV,MVNorlogicalinstruction,(ineithertheregisterorimmediate form)thecarryflagissettobethelastbitshiftedout. Ifnoshiftisdone,thecarryflagwillbeunaffected. Ifthereisachoiceofformsforanimmediate(e.g.#1couldberepresentedas1ROR#0,4ROR #2,16ROR#4or64ROR#6),theassemblerisexpectedtousetheoneinvolvingazerorotation,ifavailable.SoMOVSRn,#constwillleavethecarryflagunaffectedif0<=const<=255, butwillchangeitotherwise. aaaaAssemblerMeaningP-Code 0000ANDBooleanAndRd=RnANDOp2 0001EORBooleanEorRd=RnEOROp2 0010SUBSubtractRd=Rn-Op2 0011RSBReverseSubtractRd=Op2-Rn 0100ADDAdditionRd=Rn+Op2 0101ADCAddwithCarryRd=Rn+Op2+C 0110SBCSubtractwithcarryRd=Rn-Op2-(1-C) 0111RSCReversesubw/carryRd=Op2-Rn-(1-C) 1000TSTTestbitRnANDOp2 1001TEQTestequalityRnEOROp2 1010CMPCompareRn-Op2 1011CMNCompareNegativeRn+Op2 1100ORRBooleanOrRd=RnOROp2 1101MOVMovevalueRd=Op2 1110BICBitclearRd=RnANDNOTOp2 1111MVNMoveNotRd=NOTOp2 NotethatMVNandCMNarenotasrelatedastheyfirstappear;MVNusesstraightbitwise negation,settingRntothe1’scomplementofOp2.CMNcomparesRnwiththe2’scomplement -7-ofOp2. Theseinstructionsfallbroadlyinto4subsets: MOV,MVN Rnisignored,andshouldbe0000.IftheSbitisset,NandZaresetontheresult,andifthe shifterisused,Cissettobethelastbitshiftedout.Visunaffected. CMN,CMP,TEQ,TST Rdisnotsetbytheinstruction,andshouldbe0000.TheSbitmustbeset(mostassemblers dothisautomatically;ifitweren’tset,theinstructionwouldbeMRS,MSR,oranunallocated one.) Thearithmeticoperations(CMN,CMP)setN,Zonresult,andCandVfromtheALU. Thelogicaloperations(TEQ,TST)setNandZontheresult,Cfromtheshifterifitisused (inwhichcaseitbecomesthelastbitshiftedout),andVisunaffected. Asaspecialcase(forARMs>=6,thisonlyappliesto26bitcode),theddddfieldbeing1111 causesflags(inusermode),ortheentire26bitPSR(inprivilegedmodes)tobesetfromthe correspondingbitsoftheresult.ThisisindicatedbyaPsuffixtotheinstruction—CMNP, CMPP,TEQP,TSTP.ThisismostcommonlyusedtochangemodeviaTEQPPC,#(new modenumber).In32bitmodes,MSRshouldbeusedinstead(asTEQPetcwillnotwork). ADC,ADD,RSB,RSC,SBC,SUB IftheSbitisset,thenNandZaresetonresult,andCandVaresetfromtheALU. AND,BIC,EOR,ORR IftheSbitisset,thenNandZaresetonresult,Cissetfromtheshifterifused(inwhich caseitbecomesthelastbitshiftedout)andVisunaffected. ADDandSUBcanbeusedtomakeregisterspointtodatainapositionindependentway,eg. ADDR0,PC,#24.ThisissousefulthatsomeassemblershaveaspecialdirectivecalledADR whichgeneratestheappropriateADDorSUBautomatically.(ADRR0,fredtypicallyputsthe addressoffredintoR0,assumingfrediswithinrange). In26-bitmodes,specialcasesoccurwhenR15isoneoftheregistersbeingused: •IfRn=R15thenthevalueusedisR15withallthePSRbitsmaskedout. •IfOp2involvesR15,thenall32bitsareused. In32-bitmodes,allthebitsofR15areused. In26-bitmodes,ifRd=R15then: •IftheSbitisnotset,onlythe24bitsofthePCareset. •IftheSbitisset,boththePCandPSRareoverwritten(thoughtheMode,IandFbitswill notbealteredunlessweareinanon-usermode.) For32-bitmodes,ifRd=15,allthebitsofthePCwillbeoverwritten,exceptthetwoleastsignifi-cantbits,whicharealwayszero.IftheSbitisnotset,thatisallthathappens;iftheSbitisset, theSPSRforthecurrentmodeiscopiedtotheCPSR.Youshouldnotexecuteadataprocessing instructionwiththePCasdestinationandtheSbitsetin32-bitusermode,sinceusermodedoes nothaveanSPSR.(Bytheway,youwon’tbreaktheprocessorbydoingso—it’sjustthatthe resultsofdoingsoaren’tdefined,andmaydifferbetweenprocessors.) Theseinstructionstakethefollowingnumberofcyclestoexecute:1S+(1Sifregistercontrolled shiftused)+(1S+1NifPCchanged) 5.3.BranchInstructions

xxxx101Loooooooooooooooooooooooo

-8-TypicalAssemblerSyntax:

BEQaddress
BLNEsubroutine

Theseinstructionsareusedtoforceajumptoanewaddress,givenasanoffsetinwordsfromthe valueofthePCasthisinstructionisexecuted. Duetothepipeline,thePCisalways2instructions(8bytes)aheadoftheaddressatwhichthis instructionwasstored,soabranchwithoffset=(signextendedversionofbits0-23): destinationaddress=currentaddress+8+(4*offset) In26-bitmodes,thetop6bitsofthedestinationaddressarecleared. IftheLflagisset,thenthecurrentcontentsofPCarecopiedintoR14beforethebranchistaken. ThusR14holdstheaddressoftheinstructionafterthebranch,andthecalledroutinecanreturn withMOVPC,R14. In26-bitmodes,usingMOVSPC,R14,toreturnfromabranchwithlink,thePSRflagscanbe restoredautomaticallyonreturn.ThebehaviourofMOVSPC,R14isdifferentin32-bitmodes, andonlysuitableforreturnfromanexception. Bothbranchandbranchwithlinks,take2S+1Ncyclestoexecute. 5.4.Multiplication

xxxx000000ASddddnnnnssss1001mmmm

TypicalAssemblerSyntax:

MULEQSRd,Rm,Rs
MLARd,Rm,Rs,Rn

Theseinstructionsmultiplythevaluesof2registers,andoptionallyaddathird,placingtheresult inanotherregister. IftheSbitisset,theNandZflagsaresetontheresult,Cisundefined,andVisunaffected. IftheAbitisset,thentheeffectoftheoperationisRd=Rm.Rs+Rnotherwise,Rd=Rm.Rs. ThedestinationregistershallnotbethesameastheoperandregisterRm.R15shallnotbeused asanoperandorasthedestinationregister. Theseinstructionstake1S+16Icyclestoexecuteintheworstcase,andmaybelessdepending onarguementvalues.TheexacttimedependsonthevalueofRs,accordingtothefollowingtable:

-9-RangeofRsNumberofcycles &0—&11S+1I &2—&71S+2I &8—&1F1S+3I &20—&7F1S+4I &80—&1FF1S+5I &200—&7FF1S+6I &800—&1FFF1S+7I &2000—&7FFF1S+8I &8000—&1FFFF1S+9I &20000—&7FFFF1S+10I &80000—&1FFFFF1S+11I &200000—&7FFFFF1S+12I &800000—&1FFFFFF1S+13I &2000000—&7FFFFFF1S+14I &8000000—&1FFFFFFF1S+15I &20000000—&FFFFFFFF1S+16I Thesemultiplicationtimingsdon’tapplytoARM7DM.ARM7DMtimingsaregivenbythefollowingtable. MLA/ RangeofRsMULSMULLSMLALUMULLUMLAL &0—&FF1S+1I1S+2I1S+3I1S+2I1S+3I &100—&FFFF1S+2I1S+3I1S+4I1S+3I1S+4I &10000—&FFFFFF1S+3I1S+4I1S+5I1S+4I1S+5I &1000000—&FEFFFFFF1S+4I1S+5I1S+6I1S+5I1S+6I &FF000000—&FFFEFFFF1S+3I1S+4I1S+5I1S+5I1S+6I &FFFF0000—&FFFFFEFF1S+2I1S+3I1S+4I1S+5I1S+6I &FFFFFF00—&FFFFFFFF1S+1I1S+2I1S+3I1S+5I1S+6I 5.5.LongMultiplication(ARM7DM)

xxxx00001UAShhhhllllssss1001mmmm

TypicalAssemblerSyntax:

UMULLRl,Rh,Rm,Rs
UMLALRl,Rh,Rm,Rs
SMULLRl,Rh,Rm,Rs
SMLALRl,Rh,Rm,Rs

TheseinstructionsmultiplythevaluesofregistersRmandRstoobtaina64-bitproduct. WhentheUbitisclearthemultiplyisunsigned(UMULLorUMLAL),otherwisesigned (SMULL,SMLAL).WhentheAbitiscleartheresultisstoredwithitsleastsignificanthalfin RlanditsmostsignificanthalfinRh.WhenAisset,theresultisinsteadaddedtothecontents ofRh,Rl. Theprogramcounter,R15shouldnotbeused.Rh,RlandRmshouldbedifferent. IftheSbitisset,theNandZflagsaresetonthe64-bitresult,CandVareundefined. Timingsforthesecanbefoundaboveinthemultiplicationsection.

-10-5.6.SingleDataTransfer

xxxx010PUBWLnnnnddddooooooooooooImmediateform
xxxx011PUBWLnnnnddddccccctt0mmmmRegisterform

TypicalAssemblerSyntax:

LDRRd,[Rn,Rm,ASL#1]!
STRRd,[Rn],#2
LDRTRd,[Rn]
LDRBRd,[Rn]

Theseinstructionsload/storeawordofmemoryfrom/toaregister.Thefirstregisterusedinspecifyingtheaddressistermedthebaseregister. IftheLbitisset,thenaloadisperformed.Ifnot,astore. IfthePbitisset,thenPre-indexedaddressingisused,otherwisepost-indexedaddressingisused. IftheUbitisset,thentheoffsetgivenisaddedtothebaseregister—otherwiseitissubtracted. IftheBbitisset,thenabyteofmemoryistransferred,otherwiseawordistransferred.Thisis signifiedtoassemblersbypostfixingthemnemonicstubwitha‘B’. TheinterpretationoftheWbitdependsontheaddressingmodeused: •Forpre-indexedaddressing,Wbeingsetforcesthewritingbackofthefinaladdressusedfor theaddresstranslationintothebaseregister.(i.e.AsideeffectofthetransferisRn:=Rn +/-offset.Thisissignifiedtoassemblersbypostfixingtheinstructionwith!.) •Forpost-indexedaddressing,theaddressisalwayswrittenback,andthebitbeingsetindi-catesthatanaddresstranslationshouldbeforcedbeforethetransfertakesplace.Thisissig-nifiedtoassmeblersbypostfixingthemnemonicstubwith‘T’. Anaddresstranslationcausesthechiptotellthememorysystemthatthisisausermodetransfer,regardlessofwhetherthechipisinausermodeoraprivilegedmodeatthetime.Thisisusefule.g.whenwritingemulators:supposeforinstancethatausermodeprogramexecutesanSTF instructiontoanareaofmemorythatmaynotbewrittenbyusermodecode.Ifthisisexecuted byanFPA,itwillabort.IfitisexecutedbytheFPE,itshouldalsoabort.ButtheFPErunsina privilegedmode,soifitweretousenormalstores,theywouldn’tabort.Tomakeabortswork properly,itinsteadusesnormalstoresifitwascalledfromaprivilegedmode,butSTRTsifitwas calledfromausermode. Iftheimmediateformoftheinstructionisused,theofieldgivesa12-bitoffset.Iftheregister formisused,thenitisdecodedasforthedataprocessinginstructions,withtherestrictionthat shiftsbyregisteramountsarenotallowed. IfR15isusedasRd,thePSRisnotmodified.ThePCshouldnotbeusedinOp2. Otherrestrictions: •Don’tusewritebackorpost-indexingwhenthebaseregisteristhePC. •Don’tusethePCasRdforanLDRBorSTRB. •Whenusingpost-indexingwitharegisteroffset,don’tmakeRnandRmthesameregister (doingsomakesrecoveryfromabortsimpossible). Aloadtakes1S+1N+1I+(1S+1NifPCchanged)cycles,andastoretakes2Ncycles. 5.7.BlockDataTransfer

xxxx100PUSWLnnnnllllllllllllllll

-11-TypicalAssemblerSyntax:

LDMFDRn!,{R0-R4,R8,R12}
STMEQIARn,{R0-R3}
STMIBRn,{R0-R3}^

Theseinstructionsareusedtoload/storelargenumbersofregistersfrom/tomemoryatatime. Thememoryaddressesusedareeitherincreasingordecreasinginmemoryfromavalueheldina baseregister,Rn,(whichmayitselfbestored),andthefinaladdresscanbewrittenbackintothe base.Theseinstructionsareidealforimplementingstacks,andstoring/restoringthecontentsof registersonentry/exitfromasubroutine. TheUbitindicateswhethertheaddresswillbemodifiedby+4(set),or-4(clear)foreachregis-ter. TheWbitalwaysindicateswriteback. Ifset,theLbitindicatesaloadoperationshouldbeperformed.Ifclear,asave. ThePbitisusedindicatewhethertoincrement/decrementthebasebeforeoraftereach load/store(seethetablebelow). BitlissetifRlistobeloaded/storedbythisoperation. Assemblerstypicallyfollowthemnemonicstubwithaconditioncode,andthenatwolettercode toindicatethesettingsoftheUandWbits. StubMeaning PU DADecrementRnAftereachstore/load00 DBDecrementRnBeforeeachstore/load10 IAIncrementRnAftereachstore/load01 IBIncrementRnBeforeeachstore/load11 Synonymsfortheseexistwhichareclearerwhenimplementingstacks: StubMeaning EAEmptyAscendingstack EDEmptyDecendingstack FAFullAscendingstack FDFullDecendingstack Inanemptystack,thestackpointerpointstothenextemptyposition.Inafullonethestack pointerpointstothetopmostfullposition.Ascendingstacksgrowtowardshighlocations,and descendingstacksgrowtowardslowlocations. Theregistersarealwaysstoredsothatthelowestnumberedregisterisatthelowestaddressin memory.Thiscanaffectstackingandunstackingcode.Forinstance,ifIwanttopushR1-R4onto astack,thenloadthembacktwoatatime,togetthembacktothesameregisters,Ineedtodo somethinglike:

STMFDR13!,{R1,R2,R3,R4};PutsR1lowinmemory,i.e.atendofstack
LDMFDR13!,{R1,R2}
LDMFDR13!,{R3,R4}

foradescendingstack,butsomethinglike:

STMFAR13!,{R1,R2,R3,R4};PutsR4highinmemory,i.e.atendofstack
LDMFAR13!,{R3,R4}

-12-

LDMFAR13!,{R1,R2}

foranascendingstack. Thecodesaresynonymsasfollows: CodeLoadStore EADBIA EDIBDA FADAIB FDIADB TheSbitcontrolstwospecialfunctions,bothofwhichareindicatedtotheassemblerbyputting "ˆ "attheendoftheinstruction: •IftheSbitisset,theinstructionisLDMandR15isintheregisterlist,then: *In26-bitprivilegedmodes,all32bitsofR15willbeloaded. *In26-bitusermode,the4flagsand24PCbitsofR15willbeloaded.Bits27,26,1and0 oftheloadedvaluewillbeignored. *In32-bitmodes,all32bitsofR15willbeloaded,thoughnotethatthetwobottombitsare alwayszero,soanyonesloadedtothemwillbeignored.Inaddition,theSPSRofthecurrentmodewillbetransferredtotheCPSR;sinceusermodedoesnothaveanSPSR,this typeofinstructionshouldnotbeusedin32-bitusermode. •IftheSbitissetandeithertheinstructionisSTMorR15isnotintheregisterlist,then theusermoderegisterswillbetransferredratherthanthoseforthecurrentmode.Thistype ofinstructionshouldnotbeusedinusermode. Specialcasesoccurwhenthebaseregisterisusedinthelistofregisterstobetransferred. •Thebaseregistercanalwaysbeloadedwithoutanyproblems.However,don’tspecifywritebackifthebaseregisterisbeingloaded—youcan’tendupwithbothawritten-backvalue andaloadedvalueinthebaseregister! •Thebaseregistercanbestoredwithnocomplicationsaslongaswritebackisnotused. •Storingalistofregistersincludingthebaseregisterusingwritebackwillwritethevalueof thebaseregisterbeforewritebacktomemoryonlyifthebaseregisteristhefirstinthelist. Otherwise,thevaluewhichisusedisnotdefined. Furtherspecialcasesoccuriftheprogramcounterispresentinthelistofregisterstoloadand save. •ThePSRisalwayssavedwiththePC(in26bitmodes)(andthePCwillalwaysbe12bytes furtheron,ratherthantheusual8(inallmodes)). •Onaload,onlythebitsofthePSRthatarealterableinthecurrentmodecanbeaffected, andthenonlyiftheSbitisset. ThePCshouldnotbeusedasthebaseregister. Ablockdataload,takesnS+1N+1I+(1S+1NifPCchanged)cycles,andablockdatastore takes(n-1)S+2Ncycles,where"n"isthenumberofwordsbeingtransferred. 5.8.Softwareinterrupt

xxxx1111yyyyyyyyyyyyyyyyyyyyyyyy

TypicalAssemblerSyntax:

-13-

SWI"OS_WriteI"
SWINE&400C0

Onencounteringasoftwareinterrupt,theARMswitchesintoSVCmode,savesthecurrentvalue ofR15intoR14SVC,andjumpstolocation8inmemory,whereitassumesitwillfindaSWI handlingroutinetodecodethelower24bitsoftheSWIjustexecuted,anddowhatevertheSWI numberconcernedmeansonthatparticularoperatingsystem. AnoperatingsystemwrittenontheARMwilltypicallyuseSWIstoprovidemiscellaneousroutinesforprogrammers. ASWItakes2S+1Ncyclestoexecute(pluswhatevertimeisrequiredtodecodetheSWI numberandexecutetheappropriateroutines). 5.9.Co-processordataoperations

xxxx1110oooonnnnddddppppqqq0mmmm

TypicalAssemblerSyntax:

CDPp,o,CRd,CRn,CRm,q
CDPp,o,CRd,CRn,CRm

Thisinstructionispassedontoco-processorp,tellingittoperformoperationo,onco-processor registersCRnandCRm,andplacetheresultintoCrd. qqqmaysupplyadditionalinformationabouttheoperationconcerned. Theexactmeaningoftheseinstructionsdependsontheparticularco-processorinuse;Theabove isonlyarecommendedusageforthebits(andindeedtheFPAdoesn’tconformtoit).Theonly partwhichisobligatoryisthatppppmustbethecoprocessornumber:thecoprocessordesigneris freetoallocateoooo,nnnn,dddd,qqqandmmmmasdesired. Ifthecoprocessorusesthebitsinadifferentwaythantherecommendedone,assemblermacros willprobablybeneededtotranslatetheinstructionsyntaxthatmakessensetopeopleintothe correctCDPinstruction.ForcommonlyusedcoprocessorssuchastheFPA,manyassemblershave theextramnemonicsbuiltinanddothistranslationautomatically.(Forexample,assembling MUFEZF0,F1,#10asitsequivalentCDP1,1,CR0,CR9,CR15,3.) Currentlydefinedco-processornumbersinclude: 1and2FloatingPointunit 15CacheController Ifacalltoacoprocessorismadeandthecoprocessordoesnotrespond(normallybecuaseitisn’t there!),theundefinedinstructionvectoriscalled(exactlyasforoneoftheundefinedinstructions givenlater).ThisisusedtotransparentlyprovideFPsupportonmachineswithoutanFPA. Theseinstructionstake1S+bIcyclestoexecute,wherebisthenumberofcyclesthatthecoprocessorcausestheARMtobusy-waitbeforeitacceptstheinstruction:again,thisisunderthe coprocessor’scontrol. 5.10.Co-processordatatransferandregistertransfers

xxxx110PUNWLnnnnDDDDppppooooooooLDC/STC
xxxx1110oooLNNNNddddppppqqq1MMMMMRC/MCR

-14-Againthesedependontheparticularco-processorpinuse. NandDsignifyco-processorregisternumbers,nanddareARMprocessornumbers.oistheco-processoroperationtouse.Msignifiesbitsthecoprocessorisfreetouseasitwants. Thefirstform,denotesLDCifL=1,STCotherwise.TheinstructionbehaveslikeLDRorSTR respectively,ineachcasewithanimmediateoffset,withthefollowingexceptions. •Theoffsetis4*(oooooooo),notageneral12-bitconstant. •IfP=0(post-indexing)isspecified,Wmustbe1,andWbeing1justindicatesthatwrite-backisrequired,notthatthememorysystemshouldbetoldthatthisisausermodetrans-fer.InstructionswithP=0andW=0arereservedforfutureexpansion. •Oneormorecoprocessorregistersareloadedorstored.Thecoprocessordetermineshow manyandwhichregistersaretobeloadedorstoredfromtheDDDDandNbits:allthe ARMdoesistransferawordtoorfromtheindicatedaddress,thenanothertoorfromthe indicatedaddress+4,thenonetoorfromtheindicatedaddress+8,etc.,untilthecoprocessortellsittostop. •Byconvention,DDDDdenotesthe(first)coprocessorregistertoloadorstoreandNdenotes thelengthinsomeway,withN=1indicatinga"long"form.Coprocessordesignersarefree toignorethis... •Theassemblersyntaxisalongthelinesof:

LDCp,CRd,[Rn,#20];shortform(N=0),pre-indexed
STCLp,CRd,[Rn,#-32]!;longform(N=1),pre-indexedwithwriteback
LDCNELp,CRd,[Rn],#-100;longform(N=1),post-indexed

Thesecondformdenotes,MRC,ifL=1,MCRotherwise.MRCtransfersacoprocessorregisterto anARMregister,MCRtheotherwayaround(thelettersmayseemthewrongwayaround,but rememberthatdestinationsareusuallywrittenontheleftinARMassembler). MCRtransfersthecontentsofARMregisterRdtothecoprocessor.Thecoprocessorisfreetodo whateveritwantswithitbasedonthevaluesoftheooo,dddd,qqqandMMMMfields,thoughas usualthereisa"standard"interpretation:writeittocoprocessorregisterCRN,usingoperation ooo,withpossibleadditionalcontrolprovidedbyCRMandqqq.Theassemblersyntaxis:

MCRp,o,Rd,CRN,CRM,q

RdshouldnotbeR15foranMCRinstruction. MRCtransfersasinglewordfromthecoprocessorandputsitinARMregisterRd.ThecoprocessorisfreetogeneratethiswordinanywayitlikesusingthesamefieldsasforMCR,withthe standardinterpretationthatitcomesfromCRNusingoperationooo,withpossibleadditional controlprovidedbyCRMandqqq.Theassemblersyntaxis:

MRCp,o,Rd,CRN,CRM,q

IfRdisR15foranMRCinstruction,thetop4bitsofthewordtransferredareusedtosetthe flags;theremaining28bitsarediscarded.(Thisisthemechanismusede.g.byfloatingpointcomparisoninstructions.) LDCandSTCtake(n-1)S+2N+bIcyclestoexecute,MRCtakes1S+bI+1Ccycles,andMCR takes1S+(b+1)I+1Ccycles,wherebisthenumberofcyclesthatthecoprocessorcausesthe ARMtobusy-waitbeforeitacceptstheinstruction:again,thisisunderthecoprocessor’scontrol, andnisthenumberofwordsbeingtransferred(Notethisisunderthecoprocessor’scontrol,not theARM’s)

-15-5.11.SingleDataSwap(ARM3andlaterincludingARM2aS)

xxxx00010B00nnnndddd00001001mmmm

TypicalAssemblerSyntax:

SWPRd,Rm,[Rn]

Theseinstructionsloadawordofmemory(addressgivenbyregisterRn)toaregisterRdand storethecontentsofregisterRmtothesameaddress.RmandRdmaybethesameregister,in whichcasethecontentsofthisregisterandofthememorylocationareswapped.Theloadand storeoperationsarelockedtogetherbysettingtheLOCKpinhighduringtheoperationtoindicatetothememorymanagerthattheyshouldbeallowedtocompletewithoutinterruption. IftheBbitisset,thenabyteofmemoryistransferred,otherwiseawordistransferred. NoneofRd,Rn,andRmmaybeR15. Thisinstructiontakes1S+2N+1Icyclestoexecute. 5.12.StatusRegistertransfer(ARM6andlater)

xxxx00010s10aaaa111100000000mmmmMSRRegisterform
xxxx00110s10aaaa1111rrrrbbbbbbbbMSRImmediateform
xxxx00010s001111dddd000000000000MRS

TypicalAssemblerSyntax:

MSRSPSR_all,Rm;aaaa=1001
MSRCPSR_flg,#&F0000000;aaaa=1000
MSRNECPSR_ctl,Rm;aaaa=0001
MRSRd,CPSR

Thesbit,whensetmeansaccesstheSPSRofthecurrentprivilegedmode,ratherthantheCPSR. Thisbitmustonlybesetwhenexecutingthecommandinaprivilegedmode. MSRisusedfortransferingaregisterorconstanttoastatusregister. Theaaaabitscantakethefollowingvalues: ValueMeaning 0001SetthecontrolbitsofthePSRconcerned. 1000SettheflagbitsofthePSRconcerned. 1001SetthecontrolandflagbitsofthePSRconcerned(i.e.allthe bitsatpresent). Othervaluesofaaaaarereservedforfutureexpansion. Intheregisterform,thesourceregisterisRm.Intheimmediateform,thesourceis#b,ROR #2r. R15shouldnotbespecifiedasthesourceregisterofanMRSinstruction. MRSisusedfortransferingprocessorstatustoaregister. Thedbitsstorethedestinationregisternumber;RdmustnotbeR15. N.B.Theinstructionencodingscorrespondtothedataprocessinginstructionswithopcodes10xx (i.e.thetestinstructions)andtheSbitclear.

-16-Theseinstructionalwaysexecutein1-Scycle. 5.13.Undefinedinstructions

xxxx0001yyyyyyyyyyyyyyyy1yy1yyyyARM2only
xxxx011yyyyyyyyyyyyyyyyyyyy1yyyy

Theseinstructionsarecurrentlyundefined.Onencounteringanundefinedinstruction,theARM switchestoSVCmode(onARM3andbelow)orUndefmode(onARM6andabove),putsthe oldvalueofR15intoR14SVC(orR14UND)andjumpstolocation,whereitexpectstofind codetodecodetheundefinedinstructionandbehaveaccordingly. Notes: •Theseinstructionsaredocumentedas"undefined"becausetheyentertheundefinedinstructionprocessortrapinthisway.Plentyofotherinstructionsareundefinedintheloosersense thatnothingsayswhattheydo.Forinstance,bitpatternsoftheform: xxxx000001xxxxxxxxxxxxxx1001xxxx arerelatedtodataprocessinginstructions,multiplies,longmultipliesandSWPs,butare noneofthesebecause: *Dataprocessinginstructionswithbit25=0andbit4=1haveregistercontrolledshifts, andsomusthavebit7=0. *Multiplyinstructionshavebits23:22=00. *Longmultiplyinstructionshavebits23:22=1U. *SWPshavebit24=1. Whattheseinstructionsdosimplyisn’tdefined,whereastheoneslistedaboveareactually definedtoentertheundefinedinstructiontrap,atleastuntilsomefutureuseisfoundforthem. •Notethatthe"ARM2only"undefinedinstructionsincludethosethatbecameSWPinstructionsonARM3/ARM2asandlater. 6.Credits ThisdocumentwasoriginallywrittenbyRobinWatts,withconsiderableconsultationwithSteven Singer.ItwasthenlaterupdatedbyMarkSmithtoincludemoreinformationonARMslaterthan 2. DavidSealprovidedahugelistofcorrectionsandamendments,andunwittinglyprovidedthe basisforthetiminginformationinapostingtousenet. Variouscorrectionswerealsosubmitted/postedbyOllyBetts,CliveJones,AlainNoullez,John Veness,SverkerWibergandMarkWooding. Thankstoeveryonethathelped(andifIhavemissedyouhere,pleaseletmeknow.) JustbecauseIhaveincludedpeoplesaddresseshere,pleasedonottakethisasan invitationtomailthemanyquestionsyoumayhave! OllyBettsolly@mantis.co.uk PaulHankinpdh13@cus.cam.ac.uk RobertHarleyrobert@edu.caltech.cs CliveJonesClive.Jones@armltd.co.uk AlainNoullezanoullez@zig.inria.fr DavidSeal<addresswithheldbyrequest> StevenSingers.singer@ph.surrey.ac.uk MarkSmithee91mds2@brunel.ac.uk -17-JohnVenessjohn@uk.ac.ox.drl RobinWattsRobin.Watts@comlab.ox.ac.uk SverkerWibergsverkerw@Student.csd.UU.SE MarkWoodingcsuov@csv.warwick.ac.uk Forthosenotontheinternet,messagescanbesentbysnailmailto: RobinWatts StCatherinesCollege, Oxford, OX13UJ